Solved windowstime.exe infected?

[lucasbuck]

A friend got a message from Avast that windowstime.exe was infected (Win32ropper-NAE [Drp) and it moved it to the vault. I've did some checking on the machine and it seems clean. Anyone ever heard of that particular file getting infected? Is it needed by windows? If so, how would you go about replacing it with a clean version? Thanks for any info.

 

[PeaB4YouGo]

Check here. Looks like an infector got infected. (...or something.)

Windows Time Keeper - windowstime.exe - Program Information

I think I would run MalwareBytes, then be sure that your registry is not screwed.

 

[Jacee]

Undesirable!

 

[lucasbuck]

Thanks for the replies. Malwarebytes was fine, but before I flush the virus vault and delete it I was just wondering if it was something windows needed.

 

[Jacee]

No ... did you read the link?

 

[ThrashZone]

Undesirable!

This is not an active link ?

Edit,
Sorry I thought you embedded one (Undesirable!) oops

 

[Jacee]

Check here. Looks like an infector got infected. (...or something.)

Windows Time Keeper - windowstime.exe - Program Information

I think I would run MalwareBytes, then be sure that your registry is not screwed.

This is an active link

 

[lucasbuck]

Thanks, I couldn't really tell from the link whether it was something windows needed. I'll assume not and that it was just something malicious.

 

[Jacee]

Please download (free version) Malwarebytes' Anti-Malware to your desktop
Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
* Double-click mbam-setup.exe and follow the prompts to install the program.Right click to run as Administrator, using Windows 7 or Vista.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. Copy and Paste that log into your next reply.

 

[lucasbuck]

Thanks for offering. I did find some tarma thing and adobe air, but they were pup's so I didn't delete them. Not sure if I was supposed to.

 

[VistaKing]

Rescan the PC and once its complete make sure everything is checked when you click on Show Results then once everything is checked click on Remove Selected.

Upload the log .

Then run AdwCleaner and JRT

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Clean and confirm the prompt.


Upload the log : The log file is at C:\AdwCleaner[n].txt

Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

 

[lucasbuck]

So tarma and Adobe Air should be removed? I thought tarma was an installer for some programs and of course Air is used by Adobe products.

 

[VistaKing]

This could be removed . No Adobe listed

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.08.15.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Library :: LIBRARY-PC [administrator]

8/15/2013 12:05:05 PM
MBAM-log-2013-08-15 (19-25-59).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 413442


Folders Detected: 3
C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> No action taken.

Files Detected: 6
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> No action taken.
C:\Users\Library\AppData\Local\Temp\GBKlatAT.exe.part (PUP.Optional.AirInstaller) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll (PUP.Optional.Tarma.A) -> No action taken.

(end)

 

[lucasbuck]

I may be wrong, but I'm pretty sure MB listed Airinstaller as Adobe Air. I can recheck.

 

[VistaKing]

That's not Adobe air. go ahead and place a checkmark next to everything that was found by Malwarebytes

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Clean and confirm the prompt.


Upload the log : The log file is at C:\AdwCleaner[n].txt


Download Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

 

[lucasbuck]

Everything reported clean, thanks for the help!

 

[VistaKing]

Run

Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[lucasbuck]

It also reported as clean. Thanks again for the help!

 

[VistaKing]

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.

Log looks like this : mbam-log-yyyy-mm-dd

Log located : C:\Users\{Your UserName}\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs or C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs